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IN THE UNITED STATES PATENT AND TRADEMARK OFFICE 

Application Serial No 09/847,534 

Filing Date May 1,2001 

Inventor Novik et aJ. 

Group Art Unit 2162 

Examiner Bullock Jr, Lewis Alexander 

Attorney's Docket No MS1-694US 

Confirmation No . » 4018 

Title: Method and Apparatus for Correlating Events 



APPEAL BRIEF 



To: Commissioner for Patents 
P.O. Box 1450 

Alexandria, Virginia 22313-1450 



From: Steven R. Sponseller (TeL 509-324-9256 x250; Fax 509-323-8979) 
Customer No. 22801 



Pursuant to 37 C.F.R. §41 .37, Appellant hereby submits an appeal brief 
for application 09/847,534, filed May 1, 2001, within the requisite time from the date 
of filing the Notice of Appeal. Accordingly, Appellant appeals to the Board of 
Patent Appeals and Interferences seeking review of the Examiner's rejections. 
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(1) Real Party in Interest 

The real party in interest is Microsoft Corporation, the assignee of all right, 
title and interest in and to the subject invention. 

m Related Appeals and Interferences 

Appellant is not aware of any other appeals, interferences, or judicial 
proceedings which will directly affect, be directly affected by, or otherwise have a 
bearing on the Board's decision to this pending appeal. 

(3) Status of Claims 

Claims 1-43 stand rejected and are pending in this Application. Claims 1- 
43 are appealed. Some of claims 1-43 were previously amended. Claims 1-43 are 
set forth in the Appendix of Appealed Claims on page 16. 

(4) Status of Amendments 

A Final Office Action was issued on June 15, 2004. 

A Response to the Final Office Action was filed July 20, 2004. No 
amendments were made as part of this Response. 

An Advisory Action was issued on August 30, 2004, indicating that the 
request for reconsideration had been considered but did not place the application 
in condition for allowance. 

Appellant filed a Notice of Appeal on September 24, 2004 in response to 
the Advisory Action and the Final Office Action. 
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(5^ Summary of Claimed Subject Matter 

A concise explanation of each of the independent claims is included in this 
Summary section, including specific reference characters. These specific 
reference characters are examples of particular elements of the drawings for 
certain embodiments of the claimed invention, and the claims are not limited to 
solely the elements corresponding to these reference characters. 

With respect to independent Claim 1, as discussed for example at page 13, 
line 13 through page 14, line U, a method includes receiving a plurality of events 
(402). The method further includes applying the plurality of events to a 
correlation function (408), wherein the correlation function is implemented as a 
state machine and is configured to correlate the plurality of events. A specific 
event is generated (408) if the correlation function is satisfied by the plurality of 
events. 

With respect to independent Claim 1 1 , as discussed for example at page 1 5, 
lines 10 through 22, a method includes receiving a plurality of events and 
receiving a plurality of data elements (602). The method further includes 
identifying a plurality of correlation functions configured to correlate the plurality 
of events and the plurality of data elements (602). Additionally, the method 
applies the plurality of events and the plurality of data elements to the plurality of 
correlation functions (604) and generates a specific event (610) if at least one of 
the plurality of correlation functions is satisfied. 

With respect to independent Claim 20, as discussed for example at page 15, 
line 23 through page 16, line 13, a method includes identifying a schema for 
creating state machines (702) to correlate at least two events. The method further 

4 Application No. 09/847,534 
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includes creating an instance of a particular state machine (704) and defining 
transitions for the particular state machine by subscribing to at least one event 
(706). The method then applies an update consumer to the particular state 
machine to update the state of the particular state machine (708). 

With respect to independent Claim 28, as discussed for example at page 12, 
line 3 through page 13, line 12, and page 14, line 12 through page 15, line 9, an 
apparatus includes a plurality of event consumers (316, 322, 328 and/or 334) and 
an event correlator (310 and/or 502) coupled to the plurality of event consumers. 
The event correlator (310 and/or 502) receives events (302 and/or 504) from at 
least one event source and receives data elements (506) from at least one data 
source. The event correlator (310 and/or 502) also receives at least one correlation 
function (508) configured to correlate events (302 and/or 504) and data elements 
(506), and to apply the received events and the received data elements to the 
correlation function. The event correlator (310 and/or 502) also generates a 
specific event (510) if the received events and the received data satisfy the 
correlation function. 

With respect to independent Claim 35, as discussed for example at page 15, 
lines 10 through 22, and page 26, line 7 through page 27, line 10, a computer- 
readable media (808, 810, 814, 818 and/or 822) has stored thereon a computer 
program that, when executed by one or more processors (802), causes the one or 
more processors to receive a plurality of events (602), Additionally, the one or 
more processors identify a plurality of correlation functions (602) configured to 
correlate the plurality of events. The one or more processors also apply the 
plurality of events to the plurality of correlation functions (604 and/or 606) to 
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determine whether any of the correlation functions are satisfied by the plurality of 
events. A specific event is generated (610) if one of the plurality of correlation 
functions is satisfied by the plurality of events. 

With respect to independent Claim 40, as discussed for example at page 15, 
lines 10 through 22, a method includes receiving events from event providers 
(602) and correlating the events using a function (604 and/or 606). If the events 
are correlated, the method generates an additional event and sends the additional 
event to an event consumer (610). 

(6) Grounds of Rejection to be Reviewed on Appeal 

Claims 1-43 stand rejected under 35 US.C § 102(e) as being anticipated by 
U.S. Patent No. 6,138,171 to Walker. 

(7) Argument 

A. Rejection under 35 U.S.C. § 102(e) over U.S. Patent No. 6,138,171 to 
Walker. 

Claims 1-43 stand rejected under 35 U.S.C. § 102(e) as being anticipated by 
U.S. Patent No. 6,138,171 to Walker (hereinafter "Walker"). 
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1. Claims 1-10 

Claim 1 recites a method comprising: 
receiving a plurality of events; 

applying the plurality of events to a correlation function, wherein the 
correlation function is implemented as a state machine and is configured to 
correlate the plurality of events; and 

generating a specific event if the correlation function is satisfied by 
the plurality of events. 

Thus, the method of Claim 1 employs a correlation function that is configured to 
correlate events. Particularly, the method applies the events to the correlation 
function and generates a specific event if the correlation function is satisfied by 
the received events. As defined in the Appellant's application, the correlation 
function recited in Claim 1 may include, for example : 

An example correlation function that correlates two events generates an 
email message when two different server crashes occur within five second 
of one another. (Appellant's application, page 16, lines 17-19). 

Walker does not disclose or suggest the use of such a correlation function to 
process events. In contrast, Walker merely describes a generic software state 
machine for implementing a software application in an object oriented 
environment. (See Walker, Abstract). 

Regarding the software state machine's event processing capabilities, 
Walker states: 
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In software state machine 10, the responsibilities assigned to event 
functions are limited to processing the received event and determining if a 
logical state change is required. (Walker, col, 7, lines 38-41). 

The software state machine described by Walker is configured to process each 
received event by either changing or not changing a logical state* However, 
nothing in Walker discloses or suggests that the software state machine is capable 
of correlating multiple events. Furthermore, Walker also fails to disclose or 
suggest generating a specific event if the correlation function is satisfied by the 
events. Thus, the generic software state machine and its related components 
described by Walker are not equivalent to the correlation function recited in Claim 
1. 

The June 15, 2004 Office Action argues that: 

Walker teaches applying events to a correlation function, i.e. a state 
machine capable of handling the event, and if the correlation function is 
satisfied, i.e. if a logical state change is required or the cited state machine 
does not handle the event, generating and sending a specific event, i.e. 
communicating with another state machine via an internal event. (June 15, 
2004 Office Action, page 10), 

As discussed above, the state machine described by Walker can process an event. 
But processing an event is not equivalent to correlating multiple events. Also, 
Walker describes that two state machines can communicate with one another. 
However, the communications between state machines are used for routing an 
event to a state machine that has been delegated the responsibility to process it. 
(See Walker, col. 7, lines 47-62). This routed event is merely an existing event 
and not another specific event that is generated if the correlation function is 

8 Application No. 09/&47.534 
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satisfied by the received event. Thus, Walker fails to disclose or suggest the 
subject matter recited in Claim 1 . 

For at least these reasons, Appellant respectfully submits that Claim 1 is not 
anticipated by Walker. Given that Claims 2-10 depend from Claim 1, Appellant 
respectfully submits that those claims are likewise allowable over Walker for at 
least the same reasons. 

Accordingly, Appellant respectfully submits that Claims 1-10 are allowable 
over Walker and that the rejection of Claims 1-10 should be withdrawn. 

2. Claims 11-19 

Claim 1 1 recites a method comprising: 

receiving a plurality of events; 

receiving a plurality of data elements; 

identifying a plurality of correlation functions configured to 
correlate the plurality of events and the plurality of data elements; 

applying the plurality of events and the plurality of data elements to 
the plurality of correlation functions; and 

generating a specific event if at least one of the plurality of 
correlation functions is satisfied. 

As defined in the Appellant's application, data elements may include, for example , 
"the available disk space, the current memory utilization, and the number of users 
logged into particular servers". (Appellant's application, page 16, lines 15-17). 
Also, according to the definition in the Appellant's application, the correlation 
function recited in Claim 1 1 may include, for example: 
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An example correlation function that correlates an event with data 
generates an event when a server crashes and the available storage space on 
the server's hard drive is less than five megabytes. Another example 
correlation function pages an administrator when the available storage 
space on a server's hard disk stays below ten megabytes for at least five 
minutes. (Appellant's application, page 16, lines 19-23). 

As discussed above, although the Walker reference describes the processing of an 
event, the reference does not disclose or suggest a method that uses a correlation 
function configured to correlate events and that generates a specific event if the 
correlation function is satisfied by the events. Furthermore, Walker also fails to 
disclose or suggest a correlation function that correlates both events and data 
elements. For at least the reasons stated above, Appellant respectfully submits 
that Claim 1 1 is not anticipated by Walker and is allowable. Given that Claims 
12-19 depend from Claim 1 1, Appellant respectfully submits that those claims are 
likewise allowable over Walker for at least the same reasons, 

Accordingly, Appellant respectfully submits that Claims 11-19 are 
allowable over Walker and that the rejection of Claims 1 1-19 should be 
withdrawn. 

3. Claims 20-27 

Claim 20 recites a method comprising: 

identifying a schema for creating state machines, the state machines 
to correlate at least two events; 

creating an instance of a particular state machine; 

defining transitions for the particular state machine by subscribing to 
at least one event; and 

1 0 Application No. 09/847,534 
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applying an update consumer to the particular state machine to 
update the state of the particular state machine. 

As discussed above, Walker does not disclose or suggest a correlation function 
configured to correlate events where the correlation function is implemented as a 
state machine. Walker also fails to disclose identifying a schema for creating such 
a state machine. 

The June 1 5, 2004 Office Action suggests that Walker describes the use of 
a configuration file. (June 15, 2004 Office Action, page 6), This configuration 
file is merely used to specify and define objects. But the configuration file is not a 
schema for creating state machines to correlate events, as recited in Claim 1 1 . The 
June 15, 2004 Office Action also suggests that Walker describes that a 
programmer can modify the configuration file. (June 1 5, 2004 Office Action, 
page 6). According to Claim 20, the state of the particular state machine is 
updated by "applying an update consumer to the particular state machine". 
However, the method in Claim 20 does not require a programmer to modify a file. 
Thus, Walker fails to disclose or suggest the subject matter recited in Claim 20. 

For at least the reasons stated above, Appellant respectfully submits that 
Claim 20 is not anticipated by Walker and is allowable. Given that Claims 21-27 
depend from Claim 20, Appellant respectfully submits that Claims 21-27 are also 
allowable over Walker for at least the same reasons. 

Accordingly, Appellant respectfully submits that Claims 20-27 are 
allowable over Walker and that the rejection of Claims 20-27 should be 
withdrawn. 
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4. Claims 28-34 



Claim 28 recites an apparatus comprising: 
a plurality of event consumers; and 

an event correlator coupled to the plurality of event consumers, the 
event correlator to receive events from at least one event source and to 
receive data elements from at least one data source, the event correlator 
further to receive at least one correlation function configured to correlate 
events and data elements and to apply the received events and the received 
data elements to the correlation fiinction, wherein the event correlator 
generates a specific event if the received events and the received data 
satisfy the correlation function. 



As discussed above, Walker does not disclose using a correlation function 
configured to correlate events and data elements and generating a specific event if 
the received events and the received data satisfy the correlation function. 
Accordingly, Walker also fails to disclose the event correlator of Claim 28. 
Appellant respectfully submits that Claim 28 is not anticipated by Walker and is 
allowable for at least the reasons stated above* Given that Claims 29-34 depend 
from Claim 28, Appellant respectfully submits that Claims 29-34 are also 
allowable over Walker for at least the same reasons. 

Accordingly, Appellant respectfully submits that Claims 28-34 are 
allowable over Walker and that the rejection of Claims 28-34 should be 
withdrawn* 
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5. Claims 35-39 



Claim 35 recites: 

One or more computer-readable media having stored thereon a 
computer program that, when executed by one or more processors, causes 
the one or more processors to: 

receive a plurality of events; 

identify a plurality of correlation functions configured to correlate 
the plurality of events; 

apply the plurality of events to the plurality of correlation functions 
to determine whether any of the plurality of correlation functions are 
satisfied by the plurality of events; and 

generate a specific event if one of the plurality of correlation 
functions is satisfied by the plurality of events. 



As discussed above, Walker does not disclose using a correlation function 
configured to correlate events and generating a specific event if the events satisfy 
the correlation function. Thus, for at least the reasons stated above, Appellant 
respectfully submits that Claim 35 is not anticipated by Walker and is allowable. 
Given that Claims 36-39 depend from Claim 35, Appellant respectfully submits 
that Claims 36-39 are also allowable over Walker for at least the same reasons. 

Accordingly, Appellant respectfully submits that Claims 35-39 are 
allowable over Walker and that the rejection of Claims 35-39 should be 
withdrawn. 
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6. Claims 40-43 

Claim 40 recites a method comprising: 

receiving events from event providers; 

correlating the events using a function; and 

if the events are correlated, 

generating an additional event; and 

sending the additional event to an event consumer* 

As discussed above, Walker discloses a state machine that is capable of processing 
an event. However, Walker fails to disclose correlating multiple received events 
and generating an additional event if the received events are correlated. 

Accordingly, for at least the reasons stated above, Appellant respectfully 
submits that Claim 40 is not anticipated by Walker and is allowable. Given that 
Claims 41-43 depend from Claim 40, Appellant respectfully submits that Claims 
41-43 are also allowable over Walker for at least the same reasons. 

Accordingly, Appellant respectfully submits that Claims 40-43 are 
allowable over Walker and that the rejection of Claims 40-43 should be 
withdrawn. 



14 



Application No. 09/847.534 



PAGE 17/28* RCVD AT 12123/2004 5:41:03 PM [Eastern Standard Fime] * SVR:USPTO-EFXRF-1/0 * DNIS:8729306 * CS!D:509 323 8979* DURATION (mm-ss):0M8 



DEC 23 2004 15:01 FR LEE - HAYES PLL 509 323 8979 TO 1703872930S P. 18/28 



Conclusion 

The Office's basis and supporting rationale for the § 102(e) rejection is not 
supported by Walker. Appellant respectfully requests that the rejections be 
overturned and that pending claims 1-43 be allowed to issue. 



Respectfully Submitted, 




Reg. No. 39,384 
(509) 324-9256 ext. 250 
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(8\ Appendix of Appealed Claims 

1 . A method comprising: 
receiving a plurality of events; 

applying the plurality of events to a correlation function, wherein the 
correlation function is implemented as a state machine and is configured to 
correlate the plurality of events; and 

generating a specific event if the correlation function is satisfied by the 
plurality of events. 

r 

2. A method as recited in claim 1 wherein the correlation function is a 
class object 

3. A method as recited in claim 1 further including: 
receiving a data element; and 

applying the data element and at least one of the plurality of events to the 
correlation function. 

4. A method as recited in claim 1 further including: 
receiving a plurality of data elements; and 

applying the plurality of data elements and the plurality of events to the 
correlation function. 
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5. A method as recited in claim 1 further including communicating the 
specific event to at least one event consumer that subscribed to the specific event. 

6. A method as recited in claim 1 further including, continuing to 
receive additional events and apply the additional events to the correlation 
function if the correlation function is not satisfied by the plurality of events, 

7* A method as recited in claim 1 further including resetting the 
correlation function after generating a specific event. 

8. A method as recited in claim 1 further including: 
creating an instance of a particular state machine; and 

defining transitions for the particular state machine by subscribing to at 
least one event. 

9. A method as recited in claim 8 further including applying an update 
consumer to the particular state machine to update the state of the particular state 
machine. 

10* One or more computer-readable memories containing a computer 
program that is executable by a processor to perform the method recited in claim 
1. 
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11. A method comprising: 
receiving a plurality of events; 
receiving a plurality of data elements; 

identifying a plurality of correlation functions configured to correlate the 
plurality of events and the plurality of data elements; 

applying the plurality of events and the plurality of data elements to the 
plurality of correlation functions; and 

generating a specific event if at least one of the plurality of correlation 
functions is satisfied. 

12. A method as recited in claim 11 wherein each of the plurality of 
correlation functions is implemented as a state machine. 

13. A method as recited in claim 11 wherein each of the plurality of 
correlation functions is an instance of a class object. 

14. A method as recited in claim 11 further including communicating 
the specific event to at least one event consumer that subscribed to receive the 
specific event. 
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15. A method as recited in claim 1 1 further including: 
receiving additional events; 

receiving additional data elements; and 

applying the plurality of events, the additional events, the plurality of data 
elements and the additional data elements to the plurality of correlation functions- 

16. A method as recited in claim 1 1 further including; 
receiving additional events; 

receiving additional data elements; 
receiving additional correlation functions; and 

applying the plurality of events, the additional events, the plurality of data 
elements and the additional data elements to the plurality of correlation functions 
and the additional correlation functions, 

17. A method as recited in claim 16 further including generating the 
specific event if at least one of the plurality of correlation functions or at least one 
of the additional correlation functions is satisfied. 

18. A method as recited in claim 1 1 wherein the specific event generated 
is dependent on which correlation function is satisfied 
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19. One or more computer-readable memories containing a computer 
program that is executable by a processor to perform the method recited in claim 
11. 

20. A method comprising: 

identifying a schema for creating state machines, the state machines to 
correlate at least two events; 

creating an instance of a particular state machine; 

defining transitions for the particular state machine by subscribing to at 
least one event; and 

applying an update consumer to the particular state machine to update the 
state of the particular state machine. 

21. A method as recited in claim 20 further including deleting the 
particular state machine if the particular state machine reaches a final state. 

22- A method as recited in claim 20 wherein the particular state machine 
includes a timer, the method further including deleting the particular state machine 
if the timer expires. 

23. A method as recited in claim 20 wherein the particular state machine 
correlates at least one event and at least one data element. 
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24. A method as recited in claim 20 wherein the particular state machine 
correlates a plurality of events and a plurality of data elements. 

25. A method as recited in claim 20 further including determining a 
current state of the particular state machine. 

26. A method as recited in claim 20 wherein the particular state machine 
is an instance of a class object 

27. One or more computer-readable memories containing a computer 
program that is executable by a processor to perform the method recited in claim 
20. 

28. An apparatus comprising: 

a plurality of event consumers; and 

an event correlator coupled to the plurality of event consumers, the event 
correlator to receive events from at least one event source and to receive data 
elements from at least one data source, the event correlator further to receive at 
least one correlation function configured to correlate events and data elements and 
to apply the received events and the received data elements to the correlation 
function, wherein the event correlator generates a specific event if the received 
events and the received data satisfy the correlation function. 
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29. An apparatus as recited in claim 28 wherein the event correlator 
communicates the specific event to the plurality of event consumers. 

30. An apparatus as recited in claim 28 wherein the event correlator 
communicates the specific event to event consumers that have requested to receive 
the specific event. 

31. An apparatus as recited in claim 28 wherein the event correlator 
communicates the specific event to a plurality of filters, wherein each of the 
plurality of filters is associated with one of the plurality of event consumers. 

32. An apparatus as recited in claim 28 wherein the event correlator 
includes at least one state machine to implement the correlation function. 

33. An apparatus as recited in claim 28 wherein the event correlator 
includes at least one state machine to implement the correlation function, wherein 
the event correlator identifies a current state of each state machine. 

34. An apparatus as recited in claim 28 wherein the event correlator 
continues to receive additional events and additional data elements and apply the 
additional events and the additional data elements to the correlation function. 
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35. One or more computer-readable media having stored thereon a 
computer program that, when executed by one or more processors, causes the one 
or more processors to: 

receive a plurality of events; 

identify a plurality of correlation functions configured to correlate the 
plurality of events; 

apply the plurality of events to the plurality of correlation functions to 
determine whether any of the plurality of correlation functions are satisfied by the 
plurality of events; and 

generate a specific event if one of the plurality of correlation functions is 
satisfied by the plurality of events. 

36. One or more computer-readable media as recited in claim 35 
wherein the plurality of correlation functions are implemented as state machines. 

37. One or more computer-readable media as recited in claim 35 
wherein each of the plurality of correlation functions is implemented as a state 
machine, and wherein the state machine is a class object 

38. One or more computer-readable media as recited in claim 37 further 
causing the one or more processors to identify a current state of the state machine. 



23 



Application No, 09/847,534 



PAGE 26128 ' RCVD AT 1212312004 5:41 :03 PM [Eastern Standard Time] * SVR:USPTO-EFXRF-1/0 ■ DN1S:8729306 ' CS!D:509 323 8979 * DURATION (mm-ss):05-18 



DEC 23 2004 15=03 FR LEE - HAYES PLL 509 323 8979 TO 17038729306 P. 27/28 

39. One or more computer-readable media as recited in claim 35 further 
causing the one or more processors to: 

create a new instance of a state machine to implement a particular 
correlation function; and 

define transitions for the new instance of the state machine by subscribing 
to at least one event 

40. A method comprising: 
receiving events from event providers; 
correlating the events using a function; and 
if the events are correlated, 

generating an additional event; and 

sending the additional event to an event consumer. 

41. The method as recited in claim 40, further comprising: 
receiving data from the event providers; 

correlating the events and the data with the function; and 

if at least one event and the data are correlated, generating the additional 

event. 

42. The method as recited in claim 40, wherein the additional event is 
sent to the event consumer through a filter associated with the event consumer. 
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43. The method as recited in claim 40, wherein the event consumer 
includes at least one of at) event logging consumer, an event forwarding consumer, 
a mail consumer, and a scripting consumer. 
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